• Perform widening on the current state with another state.

  For example,

  void exampleWidening() {
      AEState as1, as2;
      NodeID a = getNodeID("a");
      as1[a] = IntervalValue(1, 5); // as1: a in [1, 5]
      as2[a] = IntervalValue(3, 10); // as2: a in [3, 10]
      AEState widenedState = as1.widening(as2); // widenedState: a in [1, +inf]
  }
  

  Input: state (an AEState)

  Output: Widened state (an AEState)

• Load and store values associated with a variable ID.

  For example,

  void exampleLoadValue() {
      AEState as;
      NodeID a = getNodeID("a");
      NodeID p = getNodeID("p");
      NodeID malloc = getNodeID("malloc");
      as[p] = AddressValue(getMemObjAddress("malloc"));
      as.storeValue(p, IntervalValue(42, 42)); // Store 42 at address p
  
      AbstractValue loadedValue = as.loadValue(p);
  
      std::cout << loadedValue.toString() << std::endl;
  }
  

  Input: varId (a NodeID), val (an AbstractValue)

  Output: Loaded value (an AbstractValue, can be Interval Value or Address Value)

• Print the abstract trace for debugging purposes.

  For example,

  void examplePrintAbstractState() {
      AEState as;
      NodeID a = getNodeID("a");
      NodeID b = getNodeID("b");
  
      as[a] = IntervalValue(1, 5); // a in [1, 5]
      as[b] = IntervalValue(3, 7); // b in [3, 7]
  
      as.printAbstractState(); // Print the abstract trace for debugging
  }
  

  Input: None

  Output: None (prints the abstract trace)

-----------Var and Value-----------
Var2(b)             :  Value: [3, 7]
Var1(a)             :  Value: [1, 5]
-----------------------------------------

Naming note. SVF master no longer exposes a separate AbstractStateManager / AEState class. The dense per-ICFGNode trace and the GEP / load / store / pointer helpers now live on SVF::AbstractInterpretation and are forwarded through methods on Assignment-3's AbstractExecution (its base class — call them as bare methods, e.g. getGepByteOffset(gep) or loadValue(ptr, node)). The per-node SVF::AbstractState value object is still returned by getAbsStateFromTrace(node) and is what you call widening / narrowing / joinWith / meetWith on.

The tables below list the SVF C++ APIs the Assignment-3 solution actually calls. They are grouped by what they operate on (statements, abstract state, IR queries, harness facade) so you can scan them in the order you will use them while writing Assignment_3.cpp.

CallPE joins all of a function's actual parameters at the entry. The result variable is the formal parameter; each operand pairs an actual parameter with its call site.

void AbstractExecution::updateStateOnCall(const CallPE* callPE) {
    AbstractState& as = getAbsStateFromTrace(callPE->getICFGNode());
    NodeID formal = callPE->getResID();
    AbstractValue joined;
    for (u32_t i = 0; i < callPE->getOpVarNum(); ++i) {
        const ICFGNode* callSite = callPE->getOpCallICFGNode(i);
        NodeID actual = callPE->getOpVarID(i);
        if (postAbsTrace().count(callSite))
            joined.join_with(postAbsTrace()[callSite][actual]);
    }
    as[formal] = joined;
}

AbstractState& as = getAbsStateFromTrace(node);            // per-node value object
auto& post = postAbsTrace();                               // Map<ICFGNode*, AbstractState>
if (post.count(prevNode))
    val.join_with(post[prevNode][someVarId]);

AbstractState is a value object (call widening / narrowing / joinWith / meetWith / printAbstractState() on it); postAbsTrace() lets you read another node's post-state by ICFG-node key.

void AbstractExecution::updateStateOnLoad(const LoadStmt* load) {
    const ICFGNode* node = load->getICFGNode();
    AbstractState& as = getAbsStateFromTrace(node);
    as[load->getLHSVarID()] =
        this->loadValue(SVFUtil::cast<ValVar>(load->getRHSVar()), node);
}

void AbstractExecution::updateStateOnStore(const StoreStmt* store) {
    const ICFGNode* node = store->getICFGNode();
    AbstractState& as = getAbsStateFromTrace(node);
    AbstractValue val = (store->getRHSVarID() == IRGraph::NullPtr)
        ? AbstractValue(AddressValue(AbstractState::nullMem()))
        : as[store->getRHSVarID()];
    this->storeValue(SVFUtil::cast<ValVar>(store->getLHSVar()), val, node);
}

void AbstractExecution::updateStateOnGep(const GepStmt* gep) {
    const ICFGNode* node = gep->getICFGNode();
    AbstractState& as = getAbsStateFromTrace(node);
    IntervalValue offset = this->getGepElementIndex(gep);
    AddressValue gepAddrs =
        this->getGepObjAddrs(SVFUtil::cast<ValVar>(gep->getRHSVar()), offset);
    as[gep->getLHSVarID()] = AbstractValue(gepAddrs);
}

• getGepElementIndex(gep) and getGepByteOffset(gep) return IntervalValues (element-index vs byte-offset views of the same GEP).
• getGepObjAddrs(pointer, offset) resolves the derived address set; iterate the result and call getIDFromAddr to walk each base object.

for (const auto& addr : ptrVal.getAddrs()) {
    if (AbstractState::isBlackHoleObjAddr(addr) || AbstractState::isNullMem(addr))
        continue;
    NodeID objId = as.getIDFromAddr(addr);
    const BaseObjVar* baseObj = svfir->getBaseObject(objId);
    if (!baseObj || !baseObj->isConstantByteSize())
        continue;
    u32_t size = baseObj->getByteSizeOfObj();
    IntervalValue baseOffset(0);
    if (auto* gepObj = SVFUtil::dyn_cast<GepObjVar>(svfir->getGNode(objId)))
        baseOffset = IntervalValue((s64_t)gepObj->getConstantFieldIdx());
    // ... compare baseOffset + accessOffset against size
}

The harness's handleCallSite is the entry point for every CallICFGNode. The supplied dispatch table in Assignment_3.cpp recommends:

• svf_assert / svf_assert_eq → handleStubFunctions(call)
• SAFE_BUFACCESS / UNSAFE_BUFACCESS / SAFE_PTRDEREF / UNSAFE_PTRDEREF → handleCheckpointStubs(call)
• nd / rand → write IntervalValue::top() to the actual-return variable on postAbsTrace()[callNode].
• SVFUtil::isExtCall(callee) → updateStateOnExtCall(callNode) then run the bug checkers on the call's pointer / length arguments.
• Otherwise → skip if ander->inSameCallGraphSCC(caller, callee), otherwise handleFunction(svfir->getICFG()->getFunEntryICFGNode(callee)) and forward postAbsTrace()[callNode] to callNode->getRetICFGNode().

Recover the internal object ID from a 0x7f****** virtual address.

AbstractState& as = getAbsStateFromTrace(node);
int internalID = as.getIDFromAddr(addr); // strips the 0x7f000000 mask

AbstractState& as = getAbsStateFromTrace(icfgNode);
as.printAbstractState();

-----------Var and Value-----------
Var4                 Value: [5, 5]
Var2                 Value: [5, 5]
Var1                 Value: {0x7f000005}
0x7f000005           Value: [5, 5]
———————————————————————————————————